Phase 2
On September 21st, Vvolis (@vvolis ) posted this tweet . As to what binary he was talking about, I have no idea, he should totally fill this little bit up with tasty little tidbits of knowledge if he gets the urge or opportunity (A comment was left on vvolis blog postthat after being decoded multiple times led to the next sentence) . Anyways, that led to the discovery of this site (via clicking the link we were handed- very difficult work). Darien (@perfectlydarien ) and Cerineg (@kerineg ) met up in #aai, and spent the next hour jumping through some simple puzzle hoops, discovering 4 obvious mp3s and one hidden (documented here) . The efforts of these two have proven futile on deciphering anything else from the site or the mp3's, so work on that. Also of potential significance: Y92s1202 was seen in #aai on September 18th for a few minutes, no messages sent. On September 29th, Y92s1202 appeared again in #aai and #valvearg, clueing cerineg in to potential updates on rlyeh_logs. Lo and behold, there was an update! From here on it's probably a safe bet that when this mysterious fellow appears, shit has went down somewhere. On October 1st, Y92s1202 appeared in #valvearg. On his initial login, he/it forgot to auth, so we know they are located somewhere near Gaston, Oregon , or are using a proxy located in the area. This may be a hint, or a goof (IMO, it's not a proxy: this IP had been visiting #valvearg under generic mibbit or ARGfan names since at least June 11th). Nothing else has appeared to have happened after this visit. On October 2nd, Cerineg noticed that, save for the root and the mp3's, all other directories were inacessible. Sometime later the same day the root directory text was changed to simply "otp22". Either they are pausing this arg for otp22 to finish, or this is somehow related. Later that day, all of the pages save for the mp3's were taken down over a period of about 2 hours. Sometime later, the mp3's were taken offline, as well. October 3rd, 3:00 pm cst. Lev became aware that the site was back online. All directories where gone, save for misc, where a base64 string (crazy!) was found. This linked us to an old wikipedia talk page . Ultimately, upon solving some simple puzzles, the known sitemap looks like The site has been down for several weeks, no sighting of Y92s1202. Either the ARG is on pause (presumably to wait for the post-otp22 crowd to get anxious), or it's dead. /rlyeh-logs | - rlyeh_frame7 | - slip1.mp3 | - slip2.mp3 | - misc | - aHR0cDovL3JseWVoLWxvZ3MuczMtd2Vic2l0Z.mp3 | - S11cy1lYXN0LTEuYW1hem9uYXdzLmNvbS9ybH.mp3 | - archive_11 | - archive_12 | - .sensitive | - instance1.mp3 | - hash1 Most of these links are only puzzle relevant, it shouldn't be that difficult for anyone likely to read this sentence to track your way through all of that. Links with asterisks next to them were hidden files or directories. --- In case that site goes offline, anything below this line is what was there previously Last login: Thu Aug 29 21:00:28 on console konz@rlyeh_frame7 ~ $ initiate ptcl_23 -Initiation failed due to insufficient privileges. konz@rlyeh_frame7 ~ $ write naos pts/0 << EOF just tried to initiate and I get insufficient privileges!!! you kidding me? How in the world did you manage to screw up the frame injection? i don’t want to hear any excuses for why this simple visit is turning into a nightmare of incompetence. Just fix the d*** thing and have it ready for the next branch sync and it’d better d*** WORK. ok? EOF konz@rlyeh_frame7 ~ $ exit Last login: Fri Aug 30 01:57:06 on console konz@rlyeh_frame7 ~ $ write naos pts/0 << EOF when you get finished fixing that fj, build me a tickler for all the reference terms. I’m seeing some weirdness in what should be standard terms and I want to know why. But fix that darn injection first. EOF konz@rlyeh_frame7 ~ $ exit Last login: Sat Sep 14 01:57:06 on console naos@rlyeh_frame7 ~ $ refresh -f ‘voynich' -Refreshing definition of 'voynich’…100% naos@rlyeh_frame7 ~ $ fork -i ‘voynich' -Creating transfer splice for 'voynich’…100% -Forking ‘voynich’ to current line…100% naos@rlyeh_frame7 ~ $ write konz pts/0 << EOF OK, I just tried a full refresh on voynich and it worked! I went ahead and pulled their version and will compare it with ours when I get a chance, hopefully we’ll find some differences worth all this trouble. If not we’ll need to try another PoD. I also uploaded the 2 audio examples of line slippage I referred to this morning. Which reminds me, you should get some sleep, you didn’t look good earlier. EOF naos@rlyeh_frame7 ~ $ exit September 29th Last login: Wed Sep 25 00:17:48 on console konz@rlyeh_frame7 ~ $ initiate ptcl_23 -Initiating ptcl_23 on current line…100% -Backing up current line state…100% -Creating new line branch…100% -Cloning line state to new branch…100% -Cleaning up current branch…100% -Synchronizing new branch to current branch…100% -Decoupling branches…100% -INITIATION COMPLETE konz@rlyeh_frame7 ~ $ write naos pts/0 << EOF Ok we’ve got a new branch to work with. We should probably let this one simmer for a few days before trying to gather any more data. EOF konz@rlyeh_frame7 ~ $ exit of the Gaston, Oregon wikipedia talk page naos - I know this is in the clear but I can't help it. I'm sure you noticed the atfalati line slippage over the past 3 days. Locals are freaking out over strange sounds in the sky - my systems have dropped and of course agent23 is denying my request for a backup unit so I'm forced to hack into these arcane networks wherever I can find them. Remind me to torture him when I get back. I did a refresh on the cherry grove petroglyph and ran a transfer splice so we have a backup copy to analyze, you should have access to it now. Tell konz to pull me out once he gets the systems back up, I'm pretty sure my location has been compromised. thanks - Y92s1202 Slip1.mp3 Slip2.mp3 aHR0cDovL3JseWVoLWxvZ3MuczMtd2Vic2l0Z.mp3 S11cy1lYXN0LTEuYW1hem9uYXdzLmNvbS9ybH.mp3 Instance1.mp3